Sam Karnick's blog "The American Culture" quotes my positive reaction to the EU's pro-privacy stance on search engines collecting IP addresses. The EU position is contrary to Google's practices. In some European countries, Google's search engine dominance is even greater than in the United States.

As a computer programmer, I think Google's practice--stripping off the last two numbers of your IP address--really is sufficient, the EPIC rep.'s characterization not withstanding.

For non-techys: IP addresses are composed of four numbers, each in the range 0-255 (actually, the first number is significantly more restricted, but I won't go into that). To identify a specific computer with a static (constant) IP address, you need to have all four numbers--and most computers actually get their IP addresses dynamically. With just the first two, you can typically identify a service provider or a company, but that's about it.

Basically, complaining about Google's tracking system is like complaining about privacy concerns when a surveyor records someone's city &state, but not their name, street, or street number. There's simply not enough information to be worried about.

If privacy is something I can trade for a free service, like Google, then it ought to be my right to do so. It seems, with all the calls for privacy, that there is plenty of room for a search engine that either ignores IP addresses as a selling point and makes money on ads alone, or a pay per search site that does not present ads or record IP addresses. Either people are very poorly informed about privacy practices, the worries are overblown, or some combination of the two. I do not think a ban on recording IP addresses is justified. Maybe a more explicit statement of privacy policies, in keeping with a well informed market, but it doesn't appear to me at least that government regulators need to out and out ban certain information being recorded.

Can someone tell us what's the problem with recording IP addresses? I note
1)telephone books routinely provide both name and phone number.
2)Addresses are prominently displayed on houses.
3)Phones record the number of every number that calls.
4)Surveillance cameras record our every movement in both public and private space.
5)Court records are public.
6)Automobile license plates are displayed for anyone to record.
7)Personal wireless network names can be detected by any computer.
8)We are free to take videos of anyone we want in public.
9)Any purchase with a credit card releases lots of information for a vendor to record.

What is he harm from recording an incomplete IP address? Are these other examples OK, but an incomplete IP address somehow different?

As a computer programmer, I think Google's practice--stripping off the last two numbers of your IP address--really is sufficient, the EPIC rep.'s characterization not withstanding.

I am not sure, but I think that the following number is an example of the kind of number stripping that Google does:

137.69.175.1##

Where "##" represents the stripped numbers. As you noted, each of the four number blocks above has a range of 0-255 (the base-10 equivalent of a two-digit hexadecimal number). So stripping the ## leaves 100 possibilities if the first digit in the last block is 1 or a blank and 56 possibilities if the first digit is a 2.

Actually, often a specific IP address cannot even be associated with a specific Internet-access computer, let alone an individual. For example, some Internet service providers (ISP's) use proxy servers that each link many individual users to the Internet, and the proxy server may have a fixed IP address or one that changes only occasionally. Also, some Internet-access computers use dynamic IP addressing to directly connect to the Internet -- i.e., the IP address directly connecting to the Internet changes each time the computer connects to the Internet (though the IP address falls within a limited range).

Elliot123 said,

Can someone tell us what's the problem with recording IP addresses?

Using IP addresses to block access, as in preventing posting of comments, is a widespread disreputable practice -- Wikipedia and apparently Volokh Conspiracy are among the websites that do it. IP address blocking is often ineffective and can block large numbers of people other than the intended target. There ought to be laws that any blog or other website that blocks comments by means of IP addresses or otherwise arbitrarily censors comments may not be cited in the courts. Also, knowledge of an IP address associated with a particular computer can be used to attack that computer.

Recording IP addresses is apparently illegal in the UK -- see this, this, and this. Recording IP addresses is also arguably illegal in California -- see this.

Google led the pack by being the first last year to cut the time it stored search information to 18 months. It also reduced the time limit on the cookies that collect information on how people use the Internet from a default of 30 years to an automatic expiration in two years.

Actually, Internet users can block or restrict the placement of cookies (small files that websites that you visit place on your hard drive), block or restrict access to cookies, and erase cookies.

common sense said,

If privacy is something I can trade for a free service, like Google, then it ought to be my right to do so.

With the scarcity of Version 4 IP addresses (with four blocks of numbers as shown above), your computer probably does not have its own static IP address unless you rent one. IP addresses can still cause you problems, though -- for example, a website could block the IP address of the Internet Service Provider proxy server that you might be using to indirectly connect to the Internet (this proxy address may change occasionally), or block a range of dynamic IP addresses that you use to directly connect to the Internet.

Hopefully the new IP address format, Version 6 (a string of six blocks of numbers instead of four as shown above), will be implemented in a way that will help prevent IP address blocking and other abuses of IP addresses.